Overview

overview

8

Static

static

1

0f78b12a7d...c5.exe

windows7-x64

8

0f78b12a7d...c5.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    0f78b12a7d1fa83c634ebe1ed5bd7aafa8b3966c0efef33f544df3c4db75afc5

  • Size

    746KB

  • Sample

    221202-3bdnbagh7t

  • MD5

    2f87febd3e3cd93f9534dcd484b4fa90

  • SHA1

    f2b83f1a4a8db289e737c486e5baef7562d9f33d

  • SHA256

    0f78b12a7d1fa83c634ebe1ed5bd7aafa8b3966c0efef33f544df3c4db75afc5

  • SHA512

    f0c8809f9770d78a716ffd8e99213b901d4da8277edddd8c5e45aacce93bc682375faf92e2f7150aae8910b18dad1c03121bc37ca86cb490ff3073c5bff00494

  • SSDEEP

    12288:CfDvmqNmRRJRIOKNOvtPRTGk35x2UBZG4Tb02Ojgw1bv7l4XKrp7CqQ+0Bt/wwy:C9NmTJVKNOvtPRPnNZLb02KL4CZCqQYV

Score
8/10
bootkitpersistenceupx

Malware Config

Targets

    • Target

      0f78b12a7d1fa83c634ebe1ed5bd7aafa8b3966c0efef33f544df3c4db75afc5

    • Size

      746KB

    • MD5

      2f87febd3e3cd93f9534dcd484b4fa90

    • SHA1

      f2b83f1a4a8db289e737c486e5baef7562d9f33d

    • SHA256

      0f78b12a7d1fa83c634ebe1ed5bd7aafa8b3966c0efef33f544df3c4db75afc5

    • SHA512

      f0c8809f9770d78a716ffd8e99213b901d4da8277edddd8c5e45aacce93bc682375faf92e2f7150aae8910b18dad1c03121bc37ca86cb490ff3073c5bff00494

    • SSDEEP

      12288:CfDvmqNmRRJRIOKNOvtPRTGk35x2UBZG4Tb02Ojgw1bv7l4XKrp7CqQ+0Bt/wwy:C9NmTJVKNOvtPRPnNZLb02KL4CZCqQYV

    Score
    8/10
    bootkitpersistenceupx

    • Blocklisted process makes network request

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks